> A virtio net header can place CHECKSUM_PARTIAL at any in-packet > offset. If that state is retained, later checksum completion can > modify the packet after protocol processing has made decisions from it. > > Let's fix that: let's validate csum_start and csum_offset and only keep > CHECKSUM_PARTIAL when csum_start and csum_offset match a parsed TCP or > UDP header, while handling VLAN headers, IPv4 options and IPv6 extension > headers. Complete other non-GSO checksums immediately, before any > protocol processing runs. > > We can't easily "complete the checksum" for GSO we don't recognize - GSO > assumes knowledge of the protocol. We could segment ignoring the > checksum then do whatever csum_start and csum_offset say, but that > seems like an overkill for something that should happen. > > UDP tunnel headers get the same handling on the inner header. > > Packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are unaffected. > > Suggested-by: Willem de Bruijn <[email protected]> > Signed-off-by: Michael S. Tsirkin <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
